Segmentation & Microsegmentation

You cannot fix the host, so the only control is what the segment permits it to originate and receive. The price is a standing exception with a named owner and a renewal date, and an intruder who lands there inherits it.

Every other host in that VLAN — with three devices a room, roughly 2,700 of them. Traffic between hosts in one broadcast domain is switched, never routed, so the inter-VLAN firewall neither filters nor logs it.

That permission already exists in every segment's rule set. Segmentation limits who may reach whom, but the shared tier is exempt by design, so owning it hands an adversary an approved path into every segment.

Almost nothing. It proves one named source group may reach one destination on those ports. What an intruder reaches is the union of every allow covering that workload's groups, then the same from each host it lands on.

A diagram is a claim, not a control. If routing carries the traffic around the firewall, an intruder crossing between those subnets meets no filter at all. Only moving the enforcement point onto the real path fixes it, and that costs a change window.

A rule export shows intent, not effect. It cannot show whether the traffic ever reaches that device, whether an earlier or later rule matches first, or whether the device is in the path at all. Only traffic originated from inside the segment produces an outcome.

Two hosts in the same subnet talk directly through the switch and never reach the default gateway, so a border firewall is simply not on that path and records nothing. Only splitting them into separately routed subnets puts a device in the way.

It removes destinations, not authority. An intruder driving a working, authenticated session keeps every permission that account already held; segmentation only shortens the list of places the account can be used from.

They rewrite the policy instead of slipping past it. A permit they add is enforced as legitimate, the traffic that follows looks authorised in every downstream record, and the device's local change log is theirs to edit too.

Their sessions run during the observation window, so the compiler writes them into the allow-list as ordinary flows. On enforcement day only missed legitimate flows break and get attention; the intruder's path breaks nothing, so nobody looks.

They stop attacking the boundary and become an allowed party. Policy grants reachability to the label, so a successful tag write buys permitted, ordinary-looking flows with no packet crafting. The tagging API is now the segmentation boundary.

Splitting one subnet into several forces traffic between them to a default gateway, and a policy applied at that routed hop is the first thing an intruder's lateral movement must cross. The cost is hairpinned traffic, added latency, a new failure domain and full re-addressing.

Stop trying to read the rules. State a short list of pairs that must never be reachable, compute effective reachability over rule text and current membership, test those invariants on every change, and show reviewers the reach delta.

Nothing binds an IP to a workload. When an instance dies its address returns to the pool, and whatever lands on it next inherits every rule that named it. Label-keying moves that trust onto an issuance path you now run.

An address-keyed permit trusts a field in the packet, not an identity the device proves, so whoever answers at that address inherits it. Holding the binding true costs static addressing, a hand-kept register and change coordination on every device swap.

An isolated port may exchange frames only with promiscuous ports, where the gateway and the address relay sit — so assignment still completes. Two guest devices are both isolated, so the host-to-host discovery casting depends on is dropped.

Everything that asked. A stateful permit carries replies back inside the same connection, so a hostile service answers every client in every segment. Outbound-only constrains who starts the conversation, never who supplies the content.

By joining a group. Policy is written against groups and compiled per virtual NIC, so a tag set by build automation, in a change queue no reviewer watches, grants every existing rule naming that group.

Absence of flow records is ambiguous: it means the device never saw the traffic, or that export was never configured, sampled it away, or dropped it. Confirm the forwarding path itself before you claim a bypass, because the claim buys an outage window somebody has to authorise.

A timeout proves only that no reply came back. It covers a filter silently discarding the packet, the packet never reaching the enforcing device at all, and the packet arriving at a destination that was off or not listening while the reply was dropped. A pass and a broken probe look identical.

On the wire the session is just an allowed address pair; on the workload an agent can tie the rule to the process that opened it. It still cannot see who drives that process, and it must run everywhere.

Everything those consoles trust. Device-administration AAA hands the logon decision to the directory, so one account in the right group is an administrator on the firewall, the sensor and the access-control policy at the same time.

Stop asking whether a flow is needed - the answer is always yes. Attribute assets rather than flows, collapse permits into repeated patterns, spend effort on boundary-crossing ones, and register the unattributable residue with a named owner.

Move the write off the workload: policy-relevant labels are set by the deployment path from a reviewed declaration, never by the workload's own credential. Then reconcile against drift and staff it - issuance is now a service with an owner.

Grant it brokered and time-boxed rather than standing: the vendor terminates on a broker you control, the path opens on request and expires by itself. A permanent permit is a doorway an intruder inherits into the segment holding your widest exceptions.

Usually the firewall's session table and connection-setup rate, plus an uplink now carrying every flow twice. And you cannot size it from flow records: the traffic you are relocating never crossed a routed hop, so none was ever exported.

It puts one device on every flow in the estate: latency on services that precede every other call, a failure domain wider than any segment, capacity sized for the aggregate, and a fail-open or fail-closed choice where both answers hurt.

Observe first, then move in the smallest reversible steps: build the permit set from real flows over a full business cycle, separate the routing change from the policy change, cut one zone pair or direction per night with a written rollback and a named owner, and accept that the gap stays open, with a dated end, until the last step.

Measure directed pairs, not zones: twelve zones give 132 ordered source-to-destination pairs before you count services. Spend the budget on low-trust sources into high-value destinations, on pairs whose denial is an actual control claim, and on pairs a change touched - and show every untested pair as unknown.